Philips Releases Vue PACS Security Advisory
Thirteen vulnerabilities have been found in Philips image-management platform
Summary
Thirteen vulnerabilities have been found in Philips image-management platform
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
Philips has released a security advisory that addresses 13 vulnerabilities in the Philips Vue Picture Archiving and Communication System (PACS) image-management platform. Successful exploitation of these vulnerabilities could allow an unauthorised attacker to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorised software, or affect system data integrity to negatively impact system confidentiality, integrity, or availability.
Philips has not received any reports of patient harm, exploitation of these issues, or incidents from clinical use.
Vulnerability details
- CVE-2020-36518 - CWE-787 - Out-of-bounds write
A third-party product component writes data past the end, or before the beginning, of the intended buffer. A CVSS v4 score of 7.1 has been calculated.
- CVE-2020-11113 - CWE-502 - Deserialisation of untrusted data
A third-party product component deserialises untrusted data without sufficiently verifying that the resulting data will be valid. A CVSS v4 score of 7.1 has been calculated.
- CVE-2020-35728 - CWE-502 - Deserialisation of untrusted data
A third-party product component deserialises untrusted data without sufficiently verifying that the resulting data will be valid. A CVSS v4 score of 9.3 has been calculated
- CVE-2021-20190 - CWE-502 - Deserialisation of untrusted data
A third-party product component deserialises untrusted data without sufficiently verifying that the resulting data will be valid. A CVSS v4 score of 9.3 has been calculated.
- CVE-2020-14061 - CWE-502 - Deserialisation of untrusted data
A third-party product component deserialises untrusted data without sufficiently verifying that the resulting data will be valid. A CVSS v4 score of 9.3 has been calculated.
- CVE-2020-10673 - CWE-502 - Deserialisation of untrusted data
A third-party product component deserialises untrusted data without sufficiently verifying that the resulting data will be valid. A CVSS v4 score of 8.7 has been calculated.
- CVE-2019-12814 - CWE-502 - Deserialisation of untrusted data
A third-party product component deserialises untrusted data without sufficiently verifying that the resulting data will be valid. A CVSS v4 score of 8.7 has been calculated.
- CVE-2017-17485 - CWE-502- Deserialisation of untrusted data
A third-party product component deserialises untrusted data without sufficiently verifying that the resulting data will be valid. A CVSS v4 score of 9.3 has been calculated.
- CVE-2021-28165 - CWE-400 - Uncontrolled resource consumption
A third-party product component does not properly control the allocation and maintenance of CPU use upon receiving a large invalid packet frame. A CVSS v4 of 8.8 has been calculated.
- CVE-2023-40223 - CWE-269 - Improper privilege management
Philips Vue PACS does not properly assign, modify, track, or check actor privileges, creating an unintended sphere of control for that actor. A CVSS v4 score of 4.8 has been calculated.
- CVE-2023-40704 - CWE-1392 - Use of default credentials
Philips Vue PACS uses default credentials for potentially critical functionality. A CVSS v4 score of 8.4 has been calculated.
- CVE-2023-40539 - CWE-521 - Weak password requirements
Philips Vue PACS does not require that users have strong passwords, which could make it easier for attackers to compromise user accounts. A CVSS v4 score of 4.8 has been calculated.
- CVE-2023-40159 - CWE-200 - Exposure of sensitive information to an unauthorised actor
A validated user not explicitly authorised to have access to certain sensitive information could access Philips Vue PACS on the same network to expose that information. A CVSS v4 score of 8.8 has been calculated.
Remediation advice
Affected organisations are encouraged to review the US Cybersecurity and Infrastructure Security Agency's (CISA) Medical Advisory ICSMA-24-200-01 and 'Philips VuePACS (2024-July-18)' on Philips Security Advisories page.
For managed services customers, Philips states that new releases will be made available upon resource availability. Releases are subject to country specific regulations. Affected organisations with questions regarding their specific Philips Vue PACS installations and new release eligibility should contact their local Philips Sales representative or submit a request in the Philips Informatics Support portal.
In addition, CISA recommends users take defensive measures to minimise the risk of exploitation of these vulnerabilities, such as:
- Minimise network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
- Locate control system networks and remote devices behind firewalls and isolating them from business networks.
- When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognising VPNs may have vulnerabilities and should be updated to the most current version available. Also recognise VPN is only as secure as the connected devices.
Remediation steps
| Type | Step |
|---|---|
| Guidance |
For the following vulnerabilities, Philips recommends upgrading to the latest Vue PACS version 12.2.8.400 released in August 2023.
|
| Guidance |
For the following vulnerabiliity, Philips recommends configuring the Vue PACS environment per 'D000763414 –Vue_PACS_12_Ports_Protocols_Services_Guide' available on Incenter. Philips also recommends upgrading to the Vue PACS version 12.2.8.410 released in October 2023.
|
| Guidance |
For the following vulnerabilities, Philips recommends configuring the Vue PACS environment per '8G7607 – Vue PACS User Guide Rev G' available on Incenter.
|
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 19 July 2024 4:07 pm